HOME     MENU     SEARCH     NEWSLETTER    
NEWS & INFORMATION FOR TECHNOLOGY PURCHASERS. UPDATED ABOUT A MINUTE AGO.
You are here: Home / Network Security / Symantec Takes Down Mega Botnet
Build Apps 5x Faster
For Half the Cost Enterprise Cloud Computing
On Force.com
Symantec Takes Down Mega Botnet
Symantec Takes Down Mega Botnet
By Jennifer LeClaire / NewsFactor Network Like this on Facebook Tweet this Link thison Linkedin Link this on Google Plus
PUBLISHED:
OCTOBER
01
2013

ZeroAccess, one of the largest-known botnets in existence today with more than 1.9 million computers in its network, is becoming a big problem for security teams. The botnet relies on peer-to-peer (P2P) and command-and-control (C&C) communications architecture to give it a high degree of availability and redundancy.

Symantec just took it down.

Given its construction and behavior, Symantec reports that ZeroAccess appears to be primarily designed to deliver payloads to infected computers. In a ZeroAccess botnet, the productive activity -- from an attacker's point of view -- is performed by the payloads downloaded to compromised computers, which boil down to two basic types, both aimed at revenue generating activities.

"One type of payload we've seen is the click fraud Trojan," Symantec wrote in a blog post. "The Trojan downloads online advertisements onto the computer and then generates artificial clicks on the ads as if they were generated by legitimate users. These false clicks count for pay-outs in pay-per-click (PPC) affiliate schemes."

Proactive and Realistic

Ken Pickering, director of engineering at CORE Security, told us botnets are fairly common and can be largely financially successful for their owners -- and that's part of the reason criminals continue to innovate around their C&C elements and the malware used to grow them.

"The real interesting part of the botnet is how it distributes tasks to the slave machines it controls. The malware itself is usually fairly straightforward, but it's the obfuscation techniques used to conceal the control servers and the actions the botnet owners take to avoid being shutdown that's the real trick," Pickering said.

"I think Symantec's attack was proactive and a realistic response to this fairly large cybercrime industry. There's not a whole lot of other ways to combat these guys. But, realistically, disabling the botnet only puts a temporary financial speed bump for these guys. Unless we actively pursue them, they'll change their tactics and adapt to scenarios like this," he added.

Bold and Daring

When Symantec is messing with an unknown group of talented criminals, the company may be asking for retaliation, Tommy Chin, technical support engineer at CORE Security, told us. As he sees it, Symantec may need to think about who they are dealing with first, and study the target to an in-depth level before acting.

"The act of taking down a quarter of a botnet will not only anger the owners of a very successful illegal business. It will also create much more difficulty in regards to taking this botnet 100 percent down due to new updates being pushed through the infected zombies. I believe a more covert approach would have been more successful in probability," Chin said.

"The decentralized P2P based botnet is already pushing a new update that will make the botnet's communications much more secure and complex. The owners don't plan to lose their network. They lost a quarter of their earnings, they are mad, and they plan to come back strong bigger than ever. Regardless, Symantec's attempts were bold and daring."

An Extreme Approach

Professional security analysts typically approach any system as though it were already compromised, and then work from there, limiting what that environment is allowed to store, modify, or access, according to Kevin O'Brien, enterprise solution architect, CloudLock.

While this approach may be extreme for home users, he told us one can imagine a world in which end-user devices -- most likely tablets or mobile platforms that are always connected and that can be remotely managed, similar to how an iPhone OS upgrade can be deployed from Cupertino with minimal-to-no end-user involvement -- are collectively monitored and managed as a service.

"This merely shifts the locus of security to the vendor," he said. "But in doing so the protection of the end-user's data and assets is transferred to a team that is presumably more experienced and capable than the users are, and who are able to control for this type of exploit on a massive scale and far more quickly than any group of individual users can."

Tell Us What You Think
Comment:

Name:

Kaspen Krustey:
Posted: 2013-10-10 @ 11:20am PT
I think Symantec couldn't take down their pants, they hype the hell out of anything they do for publicity and then do some insignificant act that rarely disrupts the criminals and as Core pointed out, they make it harder for legitimate researchers and botnet hunters to track and neutralize the entire system because of their "chest pounding" malarkey. They should stick with their crappy desktop anti-virus software and leave the heavy lifting to the experts.

Like Us on FacebookFollow Us on Twitter
TOP STORIES NOW
MAY INTEREST YOU
ISACA® offers a global community of more than 115,000 IS/IT constituents in over 180 countries. We develop and deliver industry-leading certifications, education, research and business frameworks. We equip individuals to be leaders in the fast-changing world of information systems and IT - Learn More>
MORE IN NETWORK SECURITY
Product Information and Resources for Technology You Can Use To Boost Your Business

NETWORK SECURITY SPOTLIGHT
An easily avoided security lapse -- failure to use two-factor authentication on a single server -- is being blamed for the massive computer breach that hit JPMorgan Chase this past summer.
© Copyright 2014 NewsFactor Network, Inc. All rights reserved. Member of Accuserve Ad Network.